Live › vulnerability › CVE-2026-116580
Go to dashboardSeroval is a JavaScript serializer that can rebuild complex values from text. Before version 1.6.8, a crafted input can make the deserializer call a value that an application plugin produced, so the impact depends on what that plugin exposes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Applications that deserialize untrusted Seroval input and register a plugin that returns a callable value or an object exposing an method are exposed. Applications that use Seroval only on trusted data, or without such plugins, are less exposed, but the sources do not say how much less, so the upgrade is still the safe path.
onNo product ranges from the sources yet.
npm ls seroval to list every installed Seroval version in the projecton methodfromJSON or deserialization path1.6.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-116580")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.